4618474450a8535965aa2c58e3e3a87384a973ef3c46d88ff1c132dade0655cd

Analysis

max time kernel
139s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2024, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2784-45-0x0000000000400000-0x00000000004A2000-memory.exe
Size

648KB
MD5

cab20794687bd83b5e15c9c2a42e6986
SHA1

de3090666ea38f4b2be0de1bdfa6fb8227cf6bd2
SHA256

4618474450a8535965aa2c58e3e3a87384a973ef3c46d88ff1c132dade0655cd
SHA512

1366d9c950c603c915c4962da6004ae8ade4f9fec843887221da696c97543dcd4394c0854c753bc8be7c1ac9e4a9334e7ffaa639d3d9281f1a819546a98fcb5a
SSDEEP

1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqxIzmd:nSHIG6mQwGmfOQd8YhY0/EEUG

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4268	5096	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2784-45-0x0000000000400000-0x00000000004A2000-memory.exe

C:\Users\Admin\AppData\Local\Temp\2784-45-0x0000000000400000-0x00000000004A2000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2784-45-0x0000000000400000-0x00000000004A2000-memory.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5096
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 216
  2⤵
  - Program crash
  PID:4268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5096 -ip 5096
1⤵
PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads